基于网格环境的可信计算平台共享模型

提出了一种基于网格环境的可信计算平台共享模型以提高可信与非可信节点混合环境下的整体安全性.模型允许非可信网格节点借用可信节点的可信平台模块及其核心服务以提高自身参与网络协同的可信程度,有助于提高当前网格环境中可信应用的范围.在模型中同时设计了远程协商协议、密钥迁移协议、验证和证明协议来解决共享过程中的交互问题.分析表明使用本模型可以平衡网格的安全性与代价,降低可信计算应用的门槛.     

A Method to Implement Full Anonymous Attestation for Trusted Computing Platform

Trusted computing （TC） technology is brought out by trusted computing group （TCG） to make computing as safe and reliable as people expect. Attestation is one main function specified by TCG, which is the means by which a trusted computer assures a remote computer whose platform is not tampered with. There are two protocols that implement attestation without disclosing the platform＇s real identity, which are Privacy CA-based protocol and direct anonymous attestation （DAA） protocol. However, in the first protocol the privacy CA is the bottleneck and the platform＇s identity will be disclosed if the privacy CA is compromise, while DAA protocol can do profiling when dealing with rogue hardware device. In this paper, we propose a DAA-extended new approach to ensure full anonymous attestation that can not only detect a rogue TPM, but also reveal rogue TPM＇s real identity.     

Modeling Trusted Computing

0 IntroductionThe purpose of trusted computingis to solve some of to-day’s security problems through hardware changes topersonal computer . The trusted property can be extendedfromroot of trust to entire PC platformthrough the chain oftrust[1].Root of trustis a small hardware device calledtrustedplatform module (TPM) addedto PC.A well-known project of trusted computing is trustedcomputing platformalliance(TCPA) .It is calledtrusted com-puting group (TCG) now[2 ,3]. Besides this , other…     

基于状态树的链上数据高效可信查询索引模型及方法

区块链技术以其去中心化,不可篡改等特性在分布式数据管理领域中逐渐得到关注。但区块链系统在数据查询处理方面存在查询功能单一、效率低以及查询可信性难以保证等问题。笔者基于以太坊状态树的设计思路,在保证索引不可篡改的前提下,提出一种全局索引结构KMPT,可一次定位目标区块,避免了遍历区块的检索过程,同时结合块内索引TMPT,实现了基于内容的高效区块链数据检索。经实验验证,相比于仅构建块内索引的方法,该索引模型在可接受的索引构建代价内极大提升了查询检索的效率和稳定性,还可同时提供查询数据存在或不存在证明,提升了查询结果的可信性。     

The Mechanism about Key and Credential on Trusted Computing Platform and the Application Study

0 IntroductionPeople need a secure and dependable computing environ-ment[1]. The cryptology is known as the core of com-puter security[2]. The application of cryptologyis mainly ful-filled by key management and credential mechanism.In thispaper , we should study the key management and credentialmechanismbased ontrusted computing platform,and give theactual application of these security mechanisms for buildingtrusted computing environment .1 OverviewTrusted Computing1 .1 The Original of Trus…     

An Improved Grid Security Infrastructure by Trusted Computing

Current delegation mechanism of grid security infrastructure （GSI） can＇t satisfy the requirement of dynamic, distributed and practical security in grid virtual organization. To improve this situation, a TC-enabled GSI is discussed in this paper. With TC-enabled GSI, a practical delegation solution is proposed in this paper through enforcing fine granularity policy over distributed platforms with the emerging trusted computing technologies. Here trusted platform module is treated as a tamper-resistance module to improve grid security infrastructure. With the implement of Project Daonity, it is demonstrated that the solution could gain dynamic and distributed security in grid environment.     

A trusted mobile payment environment based on trusted computing and virtualization technology

In this paper, we propose a trusted mobile payment environment （TMPE） based on trusted computing and virtualization technology. There are a normal operating system （OS） and a trusted OS （TOS） in TMPE. We store the image of TOS in a memory card to hinder tampering. The integrity of TOS is protected by means of a trusted platform module （TPM）. TOS can only be updated through a trusted third party. In addition, virtualization technology is applied to isolate TOS from normal OS. Users complete ordinary affairs in normal OS and security-sensitive affairs in TOS. TMPE can offer users a highly protected environment for mobile payment. Moreover, TMPE has good compatibility in different hardware architectures of mobile platforms. As the evaluation shows, TMPE satisfies the requirement of mobile payment well.     

基于Merkle树的微支付方案

针对PayWord协议在频繁更换商家的场合中执行效率不高的问题,提出了一种基于Merkle。树的微支付方案,它通过使用MerKle树将散列链连接起来,使多个散列链共用一个消费者数字签名,从而减少了公钥签名的数量,节省了计算开销,适用于消费者对多个商家进行支付。此外,还对该方案进行了扩展,将消费者在支付过程中的计算量由0(n)降低到O(n^1/2),因此方案的执行效率大大提高。     

TPM context manager and dynamic configuration management for trusted virtualization platform

It is absolutely critical that trusted configuration management which significantly affects trust chain establishment, sealing storage and remote attestation, especially in trusted virtualization platform like Xen whose system configuration changes easily. TPM （trusted platform module） context manager is presented to carry out dynamic configuration management for virtual machine. It manages the TPM command requests and VM （virtual machine） configurations. The dynamic configuration representa- tion method based on Merkle hash tree is explicitly proposed against TCG （trusted computing group） static configuration representation. It reflects the true VM status in real time even if the configuration has changed, and it eliminates the invalidation of configuration representation, sealing storage and remote attestation. TPM context manager supports TCG storage protection, remote attestation etc, which greatly enhances the security on trusted virtualization platform.     

Security Architecture of Trusted Virtual Machine Monitor for Trusted Computing

With analysis of limitations Trusted Computing Group （TCG） has encountered, we argued that virtual machine monitor （VMM） is the appropriate architecture for implementing TCG specification. Putting together the VMM architecture, TCG hardware and application-oriented ＂thin＂ virtual machine （VM）, Trusted VMM-based security architecture is present in this paper with the character of reduced and distributed trusted computing base （TCB）. It provides isolation and integrity guarantees based on which general security requirements can be satisfied.     

一个无可信中心的有向门限签名方案

签名只有接受者才能验证,而任何第三方只有在接受者的合作下才能验证签名的数字签名方案称之为有向签名.而在大多情况下,有向签名通常是一个人,然而当所需签名的消息代表一个群体时,就需要群体中的一部分人同意,门限签名方案就被用作解决这个问题.由于在许多特定的应用环境下,一个可被所有成员信任的可信中心并不存在,所以不需要可信中心的门限签名方案就显得很有吸引力.文章提供了一个安全有效的有向门限签名方案.     

Development of Trusted Computing Research

0 IntroductionWiththe development of informationtechnology,infor-mation market gives all-ti me thriving appearance;theother side,the attack events increased, which have affectednational security and social stabilization. Under the situation,trusted computing (TC) is required.Current trusted computing is to adding the concept oftrust to information society. Through the current technolo-gies ,the trust society would be established and informationsecurity would bei mproved.In technical fields ,…     

可信计算平台及其研究现状

可信计算平台是信息安全技术研究的一个热点。本文详细介绍了可信计算平台的组成及其体系结构,描述了可信计算平台的特点和原理机制,并对目前可信计算平台的研究现状和存在的问题进行了总结。     

A Separated Domain-Based Kernel Model for Trusted Computing

This paper fist gives an investigation on trusted computing on mainstream operation system （OS）. Based on the observations, it is pointed out that Trusted Computing cannot be achieved due to the lack of separation mechanism of the components in mainstream OS. In order to provide a kind of separation mechanism, this paper proposes a separated domain-based kernel model （SDBKM）, and this model is verified by non-interference theory. By monitoring and simplifying the trust dependence between domains, this model can solve problems in trust measurement such as deny of service （DoS） attack, Host security, and reduce the overhead of measurement.     

基于PTM的可信虚拟平台方案

在多种信息系统中,将虚拟化技术与可信计算相结合的方式是一种保障系统安全的有效手段.然而,传统基于可信平台模块(TPM)的可信系统存在着系统信任基础不明确与数据迁移计算开销大的不足.本文应用便携式可信模块(PTM)信任模型,基于Xen虚拟化平台提出了一种客户端可信虚拟化平台方案——OASIS,设计并实现了OASIS平台结构、可信启动信任链建立方法及数据迁移机制.本方案具有灵活高效、以用户为中心的特点,使用PTM作为系统信任基础,为用户提供个人化可信计算环境,为用户在多平台间漫游的应用场景提供极大的便利性.原型系统测试结果表明,本方案具有可行性.     

数字资源交易可信计数系统的设计

客观可信的交易数据是数字资源交易系统应用的重要基础．文章设计了一种基于可信计算的数字资源交易计数系统,应用密码技术实现内容安全和通信安全,应用代码验证技术实现代码完整性,保证交易数据的完整、机密和不可篡改．文章描述了该系统的总体框架、功能模块和安全机制．     

Efficient and secure multi-signature scheme based on trusted computing

A new multi-signature scheme was proposed with the extension of the direct anonymous attestation (DAA) protocol supported by trusted computing (TC) technology. Analysis and simulation results show that the signer’s privacy is well protected with dynamic anonymity, the public key and signatures have length independent of the number of signature members, new signers are allowed to join the signature without modifying the public key, and attacks caused by secret key dumping or leaking can be avoided. Biography: HAO Liming (1982–), male, Ph.D. candidate, research direction: trusted computing and trust management in P2P system.     

一种动态的无可信中心(t,n)门限签名认证方案

文章在(t,n)门限秘密共享的基础上提出了一种动态的数字签名认证方案.该方案无需可信中心,组内所有成员共同生成组私钥,至少t个合法成员才可以产生签名证书;可以动态增加或者删除成员而无须改变组私钥,减小了方案实施的代价,实现了组成员的动态管理;经过分析,证明了该方案的正确性和安全性.     

Protecting Terminals by Security Domain Mechanism Based on Trusted Computing

0 IntroductionEventhoughsignificant achievement has been madeinre-search of characteristic and abnormal actions of comput-er virus and attack, the investigation of defending the un-known computer virus and attackis progressing much slower .Under the conditions that attackers are much clever , newcomputer virus is presented continuously,the difference be-tween computer virus and normal programis less and lessclear ,detecting computer virus and attack will be more andmore difficult .Andto be the…